Fighting Back

Okay, after another round of referral log spam, I’ve decided to strike back.

Subject: Spamming of Referral Logs
From: Geof F. Morris
To: abuse@ev1.net

Dear EV1.net abuse handler:

Let me first off state that I know you have a crappy assignment, handling abuse claims in amongst everything else. I feel your pain, and if this isn’t something you can prosecute, well, I understand.

Of late, I have been getting my referral logs [http://ijsm.org/refer/], as managed by Dean Allen’s Refer script [http://textism.com/tools/refer/], spammed with fake referral links from several Web sites.

The common thread to most/all of them is one IP address: 69.57.152.89. A quick check of WHOIS led me to EV1.net.

As there are no actual links coming in, this would seem to be a violation of #13 of your AUP [http://www.ev1.net/english/aup.asp], which states:

*E-mail / Message Forging:* Forging any message header, in part or whole, of any electronic transmission, originating or passing through the EV1^® service is in violation of this AUP.

This is likely being done by forging HTTP headers and firing them at my Web server.

You may feel free to peruse my referral logs to find all instances of the referral spam. It’s open, and I’m happy to have you look. If you don’t find any on the first page, scroll to the bottom and hit Next 50 –> a few times until you see that IP show up … of late, it’s showed up with about 10 requests in a row. Refer time-stamps requests, so you’ll be able to pin this down pretty well.

Thanks for your time and consideration of this report.

Regards,

Geof Morris

Looking at this Wired article on spams sent through Windows Messenger, I have to wonder if this will be fruitless. Doesn’t hurt to try, though.